Use cases
These are the typologies the platform is being designed to address. None of them is handled by a single technique — each is approached through the combination of methods that suits its shape, which is the reason the engine has four detection layers rather than one.
A structuring pattern is a rules and aggregation problem. A mule network is a graph problem. An account takeover is mostly behavioural. Mapping typology to method is how the engine avoids treating every alert the same way.
| Typology | Rules | Machine learning | Anomaly | Graph | Primary evidence |
|---|---|---|---|---|---|
| Account takeover | Rules: contributing | Machine learning: principal method | Anomaly: principal method | Graph: contributing | Behaviour + anomaly |
| Mule networks | Rules: contributing | Machine learning: contributing | Anomaly: contributing | Graph: principal method | Graph intelligence |
| Transaction velocity | Rules: principal method | Machine learning: contributing | Anomaly: principal method | Graph: not typically used | Rules + anomaly |
| Structuring | Rules: principal method | Machine learning: contributing | Anomaly: contributing | Graph: contributing | Rules + graph |
| Beneficiary anomalies | Rules: contributing | Machine learning: contributing | Anomaly: principal method | Graph: principal method | Anomaly + graph |
| Behavioural anomalies | Rules: not typically used | Machine learning: principal method | Anomaly: principal method | Graph: not typically used | Anomaly intelligence |
| Suspicious relationships | Rules: not typically used | Machine learning: contributing | Anomaly: not typically used | Graph: principal method | Graph intelligence |
What each pattern looks like from inside the data, and the signals the platform is being designed to weigh.
The account is familiar. The person using it is not.
A credential compromise usually shows up as a cluster of small departures before it shows up as a loss — an unrecognised device, a session that behaves differently, a payee that has never been used.
Each account looks ordinary. The structure does not.
Money movement through recruited accounts is defined by its shape. Graph analytics are designed to expose the accounts, beneficiaries and devices that repeatedly appear together across otherwise unrelated transactions.
Speed is itself a signal.
Rapid sequences of transactions — across a single account, a device or a beneficiary — are evaluated against the pace that account has historically kept, rather than against a fixed ceiling.
Amounts arranged around a threshold.
Repeated transactions that sit consistently below a reporting or approval limit are assessed as a pattern across time and related accounts, not as isolated payments that each pass on their own.
A payee with no history carries no baseline.
Newly introduced or rarely used beneficiaries are assessed in context — how the payee was added, what else connects to it, and how the amount compares with the account's normal outbound behaviour.
Compared against itself, not against everyone.
Each account carries its own profile — timing, channels, amounts, counterparties. Deviation is measured against that profile, which keeps ordinary customers with unusual habits out of the queue.
Connections that no single record contains.
Links formed through shared devices, addresses, beneficiaries or transaction paths are made explicit, so an investigator can see the entities around a case rather than reconstructing them by hand.
These describe detection approaches in development. They are not a statement of deployed capability or measured performance.
If your team is working a typology that isn’t on this list, we’d rather hear about it than guess.